mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 16:04:31 +00:00
86990af9c8
- New acme role: installs acme.sh, issues certs for myrddin/merlin/gandalf via DNS-01 (name.com API), installs cert files to /etc/ssl/certs/prole/, sets up renewal cron. rc=2 (already valid) treated as ok. - New playbooks/acme.yml: runs acme role on myrddin (issues all 3 host certs) - New playbooks/certmgr.yml: cert-manager and letsencrypt-prod ClusterIssuer (HTTP-01/Traefik) for external endpoints (db/svc/api.prole.org) - Add vault references for name.com API creds to group_vars/all/vars.yml - Add prole_ssl_src_dir and prole_ssl_files to myrddin/merlin/gandalf host_vars Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
15 lines
674 B
YAML
15 lines
674 B
YAML
---
|
|
# Ensures cert-manager is installed and the letsencrypt-prod ClusterIssuer
|
|
# (HTTP-01 / Traefik) is configured in the k3s cluster.
|
|
# The multi-SAN cert for db/svc/api/git.prole.org is issued automatically
|
|
# by cert-manager once prole-svc-ingress.yaml is applied (annotation-driven).
|
|
- name: Ensure cert-manager and letsencrypt-prod ClusterIssuer
|
|
hosts: k3s_servers
|
|
become: true
|
|
tasks:
|
|
- name: Install cert-manager
|
|
ansible.builtin.include_tasks: "{{ playbook_dir }}/../roles/k3s/tasks/certmgr.yml"
|
|
|
|
- name: Configure ACME ClusterIssuer and service certificate
|
|
ansible.builtin.include_tasks: "{{ playbook_dir }}/../roles/k3s/tasks/acme_cert.yml"
|